InWIF One · prototype
Hardware-grade self-custody, designed in the open.
InWIF One is a dedicated signing device: your keys are generated inside it and never leave it. The companion app prepares transactions; the device shows you exactly what you are signing and waits for your physical confirmation.
Status: prototype
Proposed specification
What goes inside.
Secure element
CC EAL5+ / EAL6+ certified secure element for key storage and signing (candidates: Infineon OPTIGA Trust M, NXP SE050, Microchip ATECC608B — selection pending evaluation).
Application MCU
Separate MCU drives the display and USB and never holds key material in production firmware.
Secure boot
Boot ROM verifies the firmware signature against a vendor key fused at manufacture. Downgrades refused.
Display & buttons
On-device screen with two physical buttons. Every signature requires a press; details rendered by the device itself.
USB-C
CDC serial transport speaking IWDP v1. Optional BLE only after independent review.
Attestation
Per-device attestation key certified by the InWIF vendor root, checked by the app with a fresh challenge.
Offline signing
Eight steps. Your key stays home.
- 1
App builds the transaction
- 2
Sent to the device
- 3
Device decodes & displays
- 4
You verify on the device
- 5
You press confirm
- 6
Device signs internally
- 7
Signature returns
- 8
App broadcasts
Roadmap
Development stages.
- 1
Architecture & interface prototype
IWDP v1 protocol, companion driver, browser device simulator.
- 2
Secure signing prototype
Rust firmware core (protocol, tx decoding, secp256k1 signing) with host tests; dev-board bring-up next.
- 3
Custom PCB & firmware
Secure element integration, secure boot, display and button drivers.
- 4
Independent security testing
Third-party firmware review and hardware attack testing (fault injection, side channels).
- 5
Production enclosure
Aluminium enclosure, manufacturing partner, device attestation at the factory.